Download to read offline
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://idp.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
}
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-27-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://idp.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
}
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-28-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://idp.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
}
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-29-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://idp.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-30-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://cloudprovider.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
}
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-31-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
"identity_provider": {
"provider_domain": ”idp.com",
"tenant_id": "tenant-12345",
”display name": ”Identity Provider”,
”display_images": {
"large_icon_uri": "https://cloudprovider.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
"jwks_uri": "https://idp.com/fastfed/keys",
"fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start",
}
Message Flows
Identity
Provider
Service
Provider](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-32-2048.jpg)
![®
HTTP/1.1 200 OK
Content-Type: application/json
{
”application_provider": {
"provider_domain": ”service.com",
"tenant_id": "tenant-67890",
”display name": ”Service Provider”,
”display_images": {
"large_icon_uri": "https://app.com/images/tile.png",
}
"capabilities": {
"authentication_profiles": [
"urn:ietf:params:fastfed:1.0:authentication:SAML:Basic",
],
"provisioning_profiles":[
"urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle"
],
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
}
…
Message Flows
Identity
Provider
Service
Provider
Pending Registration
• IdP
• Tenant ID
• Public Key
• Expiration Date
HTTP REDIRECT
includes
location of Service configuration](https://image.slidesharecdn.com/iiw-oct2019-fastfed-191008160712/75/OIDF-Workshop-at-Verizon-Media-9-30-2019-FastFed-Working-Group-Update-36-2048.jpg)
More Related Content
![OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAut...](https://cdn.slidesharecdn.com/ss_thumbnails/gluecon2014-oidc-140521065808-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to OIDF Workshop at Verizon Media -- 9/30/2019 -- FastFed Working Group Update
OIDF Workshop at Verizon Media -- 9/30/2019 -- FastFed Working Group Update
- 1. ® FAST FED A NEWSTANDARD TO SIMPLIFY SSO ADOPTION Erik Gustavson, Engineering Manager, Google Darin McAdams, Principal Engineer, AWS
- 2. ® The Problem Low adoptionof federation in enterprise settings
- 3. ® The Problem Low adoptionof federation in enterprise settings Why? It’s hard to configure.
- 4.
- 5.
- 6. ® Strange Terminology Entity ID ACSURLIdP Metadata Signed Responses Name ID Mapping Certificate Downloads
- 7. ® User Attribute Mappings •FirstName • first_name • f_name • GivenName • given_name • givenName App wants:You have:
- 8.
- 9. ® User Provisioning More terminology! Moreto configure! JIT SCIM User Lifecycle Management
- 10. ® The Results Error: Couldnot validate SAML response
- 11.
- 12. ® Finally, Success! Until 1year later…
- 13. ® Finally, Success! Until 1year later… Security Certificate Expired!
- 14. ® Lots of Pain SystemAdministrator Budget 1-2 weeks to configure SSO to each application Identity Providers Each app is different. Custom integration & documentation. Service Providers Getting into Identity Provider catalogs. Not self-service. What should I be doing!?
- 15.
- 16.
- 17.
- 18. ® How does FastFedwork? • Does NOT replace SAML, OIDC, SCIM… • DOES orchestrate the configuration of them
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://idp.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", } Message Flows Identity Provider Service Provider
- 28. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://idp.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", } Message Flows Identity Provider Service Provider
- 29. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://idp.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", } Message Flows Identity Provider Service Provider
- 30. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://idp.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", Message Flows Identity Provider Service Provider
- 31. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://cloudprovider.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", } Message Flows Identity Provider Service Provider
- 32. ® HTTP/1.1 200 OK Content-Type:application/json { "identity_provider": { "provider_domain": ”idp.com", "tenant_id": "tenant-12345", ”display name": ”Identity Provider”, ”display_images": { "large_icon_uri": "https://cloudprovider.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } "jwks_uri": "https://idp.com/fastfed/keys", "fastfed_handshake_start_uri": "https://tenant-12345.idp.com/fastfed/start", } Message Flows Identity Provider Service Provider
- 33. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date
- 34. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date HTTP REDIRECT
- 35. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date HTTP REDIRECT includes location of Service configuration
- 36. ® HTTP/1.1 200 OK Content-Type:application/json { ”application_provider": { "provider_domain": ”service.com", "tenant_id": "tenant-67890", ”display name": ”Service Provider”, ”display_images": { "large_icon_uri": "https://app.com/images/tile.png", } "capabilities": { "authentication_profiles": [ "urn:ietf:params:fastfed:1.0:authentication:SAML:Basic", ], "provisioning_profiles":[ "urn:ietf:params:fastfed:1.0:provisioning:SCIM:FullLifeCycle" ], "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], } … Message Flows Identity Provider Service Provider Pending Registration • IdP • Tenant ID • Public Key • Expiration Date HTTP REDIRECT includes location of Service configuration
- 37. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date • Authenticate
- 38. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date • Authenticate • Confirm
- 39. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date • Authenticate • Confirm • (Optional) Reviews and Approvals
- 40. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date • Authenticate • Confirm • (Optional) Reviews and Approvals
- 41. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date Complete Registration • SAML/OIDC Metadata • SCIM Metadata • OAuth ClientID/Secret
- 42. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date Complete Registration • SAML/OIDC Metadata • SCIM Metadata • OAuth ClientID/Secret JWT, signed with private key
- 43. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date Complete Registration • SAML/OIDC Metadata • SCIM Metadata • OAuth ClientID/Secret JWT, signed with private key Valid?
- 44. ® Message Flows Identity Provider Service Provider Pending Registration •IdP • Tenant ID • Public Key • Expiration Date Complete Registration • SAML/OIDC Metadata • SCIM Metadata • OAuth ClientID/Secret JWT, signed with private key Valid?
- 45. ® Message Flows Identity Provider Service Provider• SAML/OIDCMetadata • SCIM Metadata • OAuth ClientID/Secret Response
- 46. ® Message Flows Identity Provider Service Provider • SAML/OIDCMetadata • SCIM Metadata • OAuth ClientID/Secret • SAML/OIDC Metadata • SCIM Metadata • OAuth ClientID/Secret DONE!
- 47. ® Working Group Members •ADP • AWS • Google • Microsoft • Okta • SailPoint • Salesforce • and growing…
- 48.
- 49. ® Since Identiverse • Closingout remaining issues
- 50. ® Since Identiverse • Closingout remaining issues, e.g. • IGA Providers
- 51. ® Since Identiverse • Closingout remaining issues, e.g. • IGA Providers • Provider Authentication
- 52. ® Since Identiverse • Closingout remaining issues, e.g. • IGA Providers • Provider Authentication • Wordsmithing…
- 53. ® Since Identiverse • Closingout remaining issues, e.g. • IGA Providers • Provider Authentication • Wordsmithing… • Production timelines?
- 54. ® Since Identiverse • Closingout remaining issues, e.g. • IGA Providers • Provider Authentication • Wordsmithing… • Production timelines? • Lesson from demo -> UX
Editor's Notes
- #3 Despite existence of standards like SAML or OIDC, many apps see low federation rates. Not unusual to see percentages in the single digits, or low double-digits. Customers choose to create yet-another-login-and-password instead of SSO.
- #4 The reason: Configuring SSO is hard! Let’s look at a typical experience…
- #5 44 steps to configure SSO from GSuite->AWS. This isn’t unusual.
- #6 44 steps to configure SSO from GSuite->AWS. This isn’t unusual.
- #7 If you’ve never setup SSO before, you are immediately confused by strange words. “ACS URL? What is an ACS URL?”
- #8 You need to be a translator between applications
- #9 Besides SSO, how do you create user accounts in the application?
- #10 More concepts! JIT, SCIM, Lifecycle
- #11 After configuring… this is what happens. It doesn’t work. Maybe a typo, or accidentally copied the wrong value? No helpful logging. Calling tech support.
- #12 Finally, you get it working
- #13 Until 1 year later. Guess what happens after a year
- #14 SAML certificate expiration. Now the system is broken again.
- #15 Service Providers have no easy way to add themselves to app catalogs managed by the dentity Providers. They ask the Identity experts: “You made all these standards. Please, tell us what to do!” EVERYONE IS MISERABLE.
- #16 What’s happening – a human is copying and pasting between systems. They have 4 browser windows open. The problem - humans are the most unreliable, error-prone data bus we could have chosen.
- #17 To solve it, how do we let computers talk to each other? Behind the scenes, same standards. But, computers exchange the configuration programmatically.
- #18 This was the goal of the FastFed working group. Later, we’re going to show how it works. But first, let’s show you the new experience.
- #19 Does orchestrate their configuration. Sort of a control plane, and opinionated requirements for interoperability.
- #20 Aliright, In the N minutes remaining, here’s a whirlwind tour of what’s happening behind the scenes. This is going to be FAST. Gives a taste. Toward the end, we’ll talk about where to learn more if it piques your interest.
- #21 The flow starts at the service. Someone has administrative privileges there, and wants to setup SSO. First question – what is their Identity Provider?
- #22 FastFed has a couple ways to solve this. The best user experience, and the one I’ll show here, uses their email address. In this case, the service has asked Alice for her email.
- #23 Based on the email, we can take the domain name
- #24 And, if the company has configured it, make a request to a well-known location to bootstrap. Uses an existing protocol names WebFinger, if you are familiar with it. (Although, we had to change WebFinger a little. )
- #25 We get back a location. This tells us where to find the FastFed configuration for Alice. The URL could be anything, just a place to go next.
- #26 Next the service can take this URL…
- #27 And make a call to retrieve the FastFed Metadata for Alice and her organization
- #28 What comes back is a whole lot of information. We won’t go through every detail, but a few highlights…
- #29 It includes capabilities
- #30 Here, we see this provider wants to use SAML and SCIM with a certain user schema. Another provider could prefer OpenID Connect, for example. This describes those preferences and capabilities.
- #31 We see some metadata. Things like unique IDs. Or, display names and images.
- #32 There’s also a public key. This will come in later. Just for now - remember – here’s where the service learns the public key for the Identity Provider.
- #33 Finally, a URL that points us to the next step in the handshake.
- #34 The service captures some of this information into a whitelist. The IDs, the public key. At this point, the service halts. It’s got a half-completed registration. Next step is to hand-off to the Identity Provider to finish the job.
- #35 There’s a couple ways to do this handoff, but in practice, an HTTP Redirect will be the most common. Alice is redirected to her Identity Provider using the endpoints discovered earlier.
- #36 I’m skipping over it here for time, but the redirect includes parameters for the Identity Provider to learn an equivalent set of metadata about the service. What SSO protocols does it support? What user attributes does it need?
- #37 I’m skipping over it here for time, but the redirect includes parameters for the Identity Provider to learn an equivalent set of metadata about the service. What SSO protocols does it support? What user attributes does it need?
- #38 The Identity Provider will authenticate Alice
- #39 It will confirm she really wants to configure SSO into the service.
- #40 Then, at some organizations, this will go into a security queue for approval. This is common, where even though Alice administers the service instance, the organization wants a little scrutiny before anyone in the company can launch 3rd party applications for org-wide use.
- #41 Finally, everything’s approved.
- #42 We’re ready to finish. Behind the scenes, the Identity Provider will make an HTTP request to complete the registration. Finally, the services begin exchanging metadata to for those protocols. This is the same information you were previously copying-and-pasting manually. BUT, how does the service know the call is allowed? We can’t permit a random IdP to register.
- #43 To handle this, the Identity Provider signs the message using it’s public key.
- #44 The service can validate. Does this match a pending registration? Signed with the right key?
- #45 If everything looks OK, the service accepts it. Captures the metadata from the Identity Provider.
- #46 Then, it responds with it’s own Metadata
- #47 And we’re done. What happened - apps exchanged the same metadata that human beings were copying-and-pasting before. FastFed workflow creates the trust and communication channels. They can periodically resync to get updates, like SAML certificate rotation.
- #48 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #49 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #50 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #51 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #52 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #53 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #54 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.
- #55 All the specs are online. This isn’t just Google+AWS. We want everyone to have this experience. Interested? Get involved.